The Royal Elementor Addons and Templates plugin suffers from a missing or incorrect nonce check in the wpr_filter_grid_posts() function, enabling unauthenticated attackers to submit forged requests that embed malicious scripts. When an admin clicks a crafted link or submits a form, the injected JavaScript executes in the admin’s browser session, potentially exposing session cookies or permitting further malicious actions. The weakness is identified as CWE‑352, a Cross‑Site Request Forgery flaw that results in reflected cross‑site scripting.

The vulnerability affects the Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin in all builds up to and including version 1.7.1006. The impacted code resides in the wpr_filter_grid_posts() handler within the plugin’s class files.

The CVSS score of 6.1 indicates moderate risk, while the EPSS score of less than 1% shows a low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. Exploitation requires convincing a site administrator to click on a malicious link or submit a forged form, taking advantage of the absent or improperly validated CSRF token.